Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 421 to 432 of 5924
FBI Disrupts Chinese QTFY Espionage Network: How Advanced Proxy Infrastructure Threatens Critical Systems
In August 2026, the FBI disrupted a sophisticated Chinese state-sponsored cyber espionage operation run by threat actor QTFY/QT/QTCYBER, which provided reconnaissance, proxy management, and operational routing capabilities for attacks on U.S. critical infrastructure. The group, connected to China's Ministry of State Security and employing former People's Liberation Army members, operated QScan reconnaissance platforms and QTRouter obfuscation networks to target NASA, the Federal Reserve, Departments of Energy and Justice, NIH, and the U.S. Senate. Their infrastructure utilized compromised IoT devices and commercial proxy services to create an evasive Operational Relay Box (ORB) network that blended espionage traffic with legitimate consumer proxy traffic. This incident highlights the evolving sophistication of state-sponsored espionage operations that increasingly leverage commercial proxy infrastructure and compromised IoT devices to evade detection, representing a significant escalation in cyber warfare tactics targeting critical national infrastructure.
2 weeks ago
Kill Chain
Critical SharePoint RCE Chain: How CVE-2026-55040 and CVE-2026-63520 Enable Remote Code Execution
In August 2026, threat actors began actively exploiting a chained vulnerability in Microsoft SharePoint servers, combining CVE-2026-55040 (JWT authentication bypass) and CVE-2026-63520 (Business Connectivity Services RCE) to achieve remote code execution on unpatched systems. The attack chain allows unauthenticated attackers to first bypass authentication through JWT token validation flaws, then escalate to full code execution via SharePoint's Business Connectivity Services. With over 8,700 SharePoint servers exposed online and proof-of-concept exploits publicly available, CISA ordered federal agencies to immediately patch their systems as exploitation was detected in honeypots within days of PoC release. This incident represents a critical escalation in SharePoint targeting, with CISA having flagged 15 actively exploited SharePoint vulnerabilities since 2021, eight of which were used by ransomware groups. The rapid weaponization timeline demonstrates how quickly adversaries adapt public exploits for mass scanning and targeted attacks against enterprise collaboration platforms.
2 weeks ago
Kill Chain
Boston Scientific Cyberattack Disrupts Global Medical Device Operations
On August 25, 2026, Boston Scientific, a major medical device manufacturer with $20 billion in annual revenue, suffered a cyberattack that disrupted IT systems and caused global operational outages. The incident impacted critical business applications and halted the company's ability to process and ship customer orders across its 127-country presence. While the attack vector and threat actor remain undisclosed, the company activated incident response procedures and engaged external cybersecurity experts for containment and investigation efforts. The attack highlights the increasing threat to critical healthcare infrastructure and medical device supply chains. Healthcare organizations face heightened risks as ransomware groups target high-value entities with essential services, potentially affecting patient care and medical device availability worldwide.
2 weeks ago
Kill Chain
GPUThor Rowhammer Attack Defeats NVIDIA ECC Protection in AI Infrastructure
University of Toronto researchers disclosed GPUThor, a sophisticated Rowhammer attack that bypasses NVIDIA's Error-Correcting Code (ECC) protections on Ampere-class workstation GPUs including RTX A4000, A4500, A5000, and A6000 models. The attack exploits undocumented GPU behaviors to avoid Target Row Refresh mitigations, achieving bit-flip rates up to 377,000 flips per GB and enabling denial-of-service conditions and root-level privilege escalation within 1.1 minutes. GPUThor demonstrates 4,548 to 23,597 times higher effectiveness than previous GPU Rowhammer attacks, posing significant risks to AI infrastructure and cloud environments relying on these widely deployed GPU models for machine learning workloads. This vulnerability highlights the growing sophistication of hardware-level attacks targeting AI infrastructure as organizations increasingly depend on GPU-accelerated computing for critical business operations and model training.
2 weeks ago
Kill Chain
Critical Zero-Click RCE in Avada WordPress Theme Exposes 1 Million+ Websites
A critical vulnerability chain tracked as CVE-2026-18431 in the popular Avada WordPress theme and Fusion Builder plugin enables unauthenticated attackers to execute arbitrary PHP code through a sophisticated six-step zero-click attack. The flaw, discovered by Wordfence's AI-powered Argus system, affects Avada versions up to 7.16 and Fusion Builder versions up to 3.16, potentially compromising over 1 million websites. The exploit chains together authorization bypass, input validation failures, trust boundary violations, and file handling weaknesses to achieve complete server compromise. ThemeFusion has released patches in versions 7.16.1 and 3.16.1 respectively. This incident highlights the growing sophistication of WordPress theme vulnerabilities and demonstrates how AI-powered security research tools are accelerating both vulnerability discovery and exploitation timelines. The complex multi-step attack chain represents an evolution in web application threats that bypass traditional security controls.
2 weeks ago
Kill Chain
The Q2 2026 Vulnerability Crisis: When AI Acceleration Meets Exploit-First Disclosure
Q2 2026 witnessed an unprecedented surge in registered CVEs driven by widespread AI adoption in vulnerability research and application development. The period saw the emergence of the Dirty Frag family of Linux kernel vulnerabilities, including CVE-2026-43284 and CVE-2026-43500, which enable local privilege escalation through exploitation of the networking subsystem and page cache mechanisms. Simultaneously, security researcher Nightmare Eclipse published multiple Windows vulnerabilities including BlueHammer, RedSun, and YellowKey with functional exploits before CVE assignment or patches became available, establishing a dangerous precedent of exploit-first disclosure. The quarter also revealed significant security gaps in AI tools and LLM platforms, with injection vulnerabilities and improper access controls becoming increasingly prevalent as organizations rapidly integrate AI technologies without adequate security considerations.
2 weeks ago
Kill Chain
How FBI Takedown of Chinese QTFY Network Exposes Critical Zero Trust Gaps
In August 2026, the FBI disrupted a sophisticated Chinese state-sponsored cyber espionage operation conducted by the QTFY threat group, operated by Nanjing Xinjiuwei Network Technology Company. The group utilized QScan and QTRouter platforms to create an obfuscation network of compromised IoT devices and commercial proxies, enabling attacks against critical U.S. infrastructure including NASA, the Federal Reserve, Department of Energy, and the U.S. Senate. The operation leveraged zero-day vulnerabilities in Ivanti CSA appliances and numerous N-day exploits to establish persistent access while using the botnet to mask attack origins. This incident demonstrates the evolving sophistication of state-sponsored threat actors who are increasingly adopting industrialized, multi-tenant infrastructure models for large-scale espionage campaigns. The use of legitimate commercial proxy services mixed with compromised devices represents a significant challenge to traditional IP-based blocking and geographic filtering defenses.
2 weeks ago
Kill Chain
Iranian APT Nimbus Manticore Deploys Advanced SSH Tunneling and Backdoor Tools
In August 2026, cybersecurity researchers discovered new infrastructure and previously undocumented malware tools used by Nimbus Manticore, an Iranian state-sponsored hacking group linked to the Islamic Revolutionary Guard Corps (IRGC). The threat actor has expanded their arsenal with a TWOSTROKE-like C++ backdoor and an SSH tunneling utility that masquerades as Windows Terminal Server SDK components. Group-IB's analysis revealed extensive infrastructure spanning Europe and the Middle East, indicating an expanded targeting profile beyond their traditional focus on defense, aerospace, and military organizations in the Middle East and United States. This incident highlights the continued evolution of Iranian APT capabilities and their persistent focus on establishing long-term access to critical infrastructure. As nation-state actors increasingly develop sophisticated toolsets and expand their geographic reach, organizations must prioritize comprehensive network visibility and east-west traffic monitoring to detect lateral movement and command-and-control activities.
2 weeks ago
Kill Chain
North Korean APT Group Exploits AI Development Supply Chain in Sophisticated Campaign
In July 2026, Amazon's threat intelligence team identified a North Korean state-sponsored hacker group behind multiple open-source supply chain attacks targeting NPM packages including axios, debug, chalk, and typo-crypto. The DPRK-linked threat actor demonstrated evolved tradecraft leveraging generative AI to enhance their attack methodologies. Simultaneously, AWS published 21 security bulletins addressing critical vulnerabilities across open-source SDKs, MCP servers, and developer tools, with key themes including credential disclosure, SSRF attacks, command injection, and insufficient input validation in AI-integrated workflows. This incident highlights the growing sophistication of nation-state actors exploiting the software supply chain, particularly as organizations rapidly adopt AI-powered development tools and agent-based workflows that expand the attack surface through LLM integrations.
3 weeks ago
Kill Chain
First Android Malware Targeting Car Head Units Discovered in MoYu Group Campaign
In August 2026, Kaspersky researchers discovered JarService, the first documented Android malware specifically targeting automotive head units. The malware, attributed to the MoYu Group behind the notorious BadBox botnet, infected DoFun-manufactured car head units by exploiting vulnerabilities in the TWCore firmware update system. The multistage downloader spreads through legitimate update functionality and ultimately deploys click-fraud malware and reverse-proxy modules to recruit infected vehicles into a botnet for ad fraud purposes. While the infected infotainment systems pose no direct physical safety risks to drivers, this represents a significant expansion of botnet operations into connected vehicle infrastructure. This incident highlights the growing threat surface as cybercriminals increasingly target IoT and connected vehicle ecosystems. With automotive systems becoming more interconnected and the rise of software-defined vehicles, securing update mechanisms and embedded systems has become critical for preventing botnet recruitment and protecting connected infrastructure from exploitation.
3 weeks ago
Kill Chain
Mastering AWS Multi-Stage Attack Detection Through Cross-Service Correlation
AWS published a comprehensive guide detailing how cybersecurity teams can detect sophisticated multi-stage attacks by correlating signals across multiple cloud services including CloudTrail, GuardDuty, VPC Flow Logs, and Route 53 Resolver. The guidance demonstrates how attackers move through five phases - initial access, discovery, privilege escalation, lateral movement, and exfiltration - leaving distinct signatures in different AWS services. By combining AWS detection capabilities with business-specific context such as data classification and access norms, security teams can identify attack patterns that individual service alerts might miss, particularly when threat actors use legitimate credentials and authorized API calls to mask their activities. This guidance becomes critical as cloud environments face increasingly sophisticated attacks where adversaries leverage valid authentication mechanisms and blend malicious activities with normal business operations. The rise of multi-cloud environments and the growing sophistication of nation-state actors make cross-service correlation essential for modern threat detection.
3 weeks ago
Kill Chain
State Actors and Ransomware Groups Converge on Edge Infrastructure: What the Tenable-SentinelOne Analysis Reveals
A joint analysis by Tenable and SentinelOne of 93 CVE-actor attribution pairs revealed that state-sponsored threat actors and cybercriminals independently converge on the same edge infrastructure vulnerabilities across major vendors including F5, Fortinet, Citrix, and Ivanti. The research found that 54% of F5 customer environments have at least one exposed, actively-exploited CVE, while twelve vulnerabilities showed confirmed multi-nexus attribution spanning China, Russia, DPRK, Iran, and ransomware groups. High-priority CVEs paradoxically take 24 days longer to remediate than standard vulnerabilities, creating extended windows of opportunity for attackers targeting VPN gateways, firewalls, and remote access appliances. This convergence highlights the urgent need for organizations to rethink their approach to edge device security as nation-state actors increasingly share attack surfaces with cybercriminals, making traditional threat-model assumptions obsolete in an era of blended adversary tactics.
3 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
